CmdID

CmdID / Commands

evil-winrm

Windows Remote Management (WinRM) shell for pentesting. tldr-pages

On several platforms 1 Sigma rule name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Several platforms

from tldr-pages, CC BY 4.0

Windows Remote Management (WinRM) shell for pentesting. Once connected, we get a PowerShell prompt on the target host.

Connect to a host and start an interactive session

evil-winrm --ip ip_address --user user --password passwordIdentify

Trips 1 Sigma rule: highLinux HackTool Execution by Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])

Connect to a host using pass-the-hash authentication instead of a password

evil-winrm --ip ip_address --user user --hash nt_hashIdentify

Trips 1 Sigma rule: highLinux HackTool Execution by Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])

Connect to a host, specifying directories for PowerShell scripts and executables

evil-winrm --ip ip_address --user user --password password --scripts path/to/scripts --executables path/to/executablesIdentify

Trips 1 Sigma rule: highLinux HackTool Execution by Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])

Connect to a host, using SSL

evil-winrm --ip ip_address --user user --password password --ssl --pub-key path/to/pubkey --priv-key path/to/privkeyIdentify

Trips 1 Sigma rule: highLinux HackTool Execution by Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])

[Interactive] Upload a file to the host

upload path/to/local_file path/to/remote_file

[Interactive] List all loaded PowerShell functions

menu

[Interactive] Load a PowerShell script from the --scripts directory

script.ps1

[Interactive] Invoke a binary on the host from the --executables directory

Invoke-Binary binary.exe

What detects it

Sigma process creation rules that name evil-winrm
highLinux HackTool ExecutionNasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])